Fix potential integer overflow in fpdf_render_image.cpp

core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
 #include "../../../include/fpdfapi/fpdf_pageobj.h"
+#include "../../fxcrt/fx_safe_types.h"
 #include "../fpdf_page/pageint.h"
 #include "render_int.h"
 FX_BOOL CPDF_RenderStatus::ProcessImage(CPDF_ImageObject* pImageObj, const CFX_AffineMatrix* pObj2Device)
 {
     CPDF_ImageRenderer render;
     if (render.Start(this, pImageObj, pObj2Device, m_bStdCS, m_curBlend)) {
         render.Continue(NULL);
     }
     return render.m_Result;
 }
@@ skipping 978 matching lines @@
         FX_ARGB back_color = 0xff000000;
         if (pBC) {
             CPDF_Dictionary* pDict = pGroup->GetDict();
             if (pDict && pDict->GetDict(FX_BSTRC("Group")))
                 pCSObj = pDict->GetDict(FX_BSTRC("Group"))->GetElementValue(FX_BSTRC("CS"));
             else
                 pCSObj = NULL;
             pCS = m_pContext->m_pDocument->LoadColorSpace(pCSObj);
             if (pCS) {
                 FX_FLOAT R, G, B;
-                FX_DWORD num_floats = 8;
-                if (pCS->CountComponents() > (FX_INT32)num_floats) {
-                    num_floats = (FX_DWORD)pCS->CountComponents();
+                FX_DWORD comps = 8;
+                if (pCS->CountComponents() > static_cast<FX_INT32>(comps)) {
+                    comps = (FX_DWORD)pCS->CountComponents();
                 }
-                CFX_FixedBufGrow<FX_FLOAT, 8> float_array(num_floats);
+                CFX_FixedBufGrow<FX_FLOAT, 8> float_array(comps);
                 FX_FLOAT* pFloats = float_array;
-                FXSYS_memset32(pFloats, 0, num_floats * sizeof(FX_FLOAT));
+                FX_SAFE_DWORD num_floats = comps;
+                num_floats *= sizeof(FX_FLOAT);
+                if (!num_floats.IsValid()) {
+                    return NULL;  
+                } 
+                FXSYS_memset32(pFloats, 0, num_floats.ValueOrDie());
                 int count = pBC->GetCount() > 8 ? 8 : pBC->GetCount();
                 for (int i = 0; i < count; i ++) {
                     pFloats[i] = pBC->GetNumber(i);
                 }
                 pCS->GetRGB(pFloats, R, G, B);
                 back_color = 0xff000000 | ((FX_INT32)(R * 255) << 16) | ((FX_INT32)(G * 255) << 8) | (FX_INT32)(B * 255);
                 m_pContext->m_pDocument->GetPageData()->ReleaseColorSpace(pCSObj);
             }
         }
         bitmap.Clear(back_color);
@@ skipping 50 matching lines @@
         }
     } else {
         FXSYS_memcpy32(dest_buf, src_buf, dest_pitch * height);
     }
     if (pFunc) {
         delete pFunc;
     }
     FX_Free(pTransfer);
     return pMask;
 }